PT-2026-25722 · Nextclickventures · Realtyscript

CVE-2015-20119 · Publicado 2026-03-15 · Atualizado 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RealtyScript version 4.0.2

Description RealtyScript 4.0.2 contains a stored cross-site scripting issue that allows authenticated attackers to inject malicious HTML and iframe elements. Attackers can submit POST requests to the add page action with crafted iframe payloads in the text parameter within the pages.php admin interface. This allows the storage of malicious content that executes in the browsers of users viewing the affected pages. The vulnerable parameter is text.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize the text parameter in the pages.php file to prevent the injection of malicious HTML and iframe elements. Restrict access to the pages.php admin interface to authorized personnel only.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-20119

Produtos afetados

Realtyscript

Referências · 5

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2015-5269.php · Exploit
• 🔥 https://exploit-db.com/exploits/38496 · Exploit
• https://t.me/CVEtracker/47449 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2015-20119 · Nota de Segurança
• https://vulncheck.com/advisories/realtyscript-stored-cross-site-scripting-via-text-parameter-in-pages-php · Nota